Executor

Why it's ranked here

MIT licensed, with five ways to run the same runtime: a global npm command, a desktop app for Mac, Windows and Linux, a hosted service with a free tier, and self-hosting on Docker or Cloudflare. The safety story is in the code, not just the pitch: the sandbox has hard memory and time ceilings, outbound fetch throws an error, and the self-host secret store uses authenticated encryption. Unit, integration and browser end-to-end suites ship in the repository. The open question is churn, since the project's own vision document describes core models still being reshaped.

What's good

Policy defaults come from the imported spec, so read-only HTTP calls are allowed out of the box and destructive ones can arrive pre-marked for approval. A paused run, waiting on a login or a sign-off, can be resumed later by its execution id rather than restarted. The sandbox caps each run at 64 MB of memory and a five-minute budget by default, and the clock pauses while a tool call is in flight. The telemetry page lists every event it sends, states that no code, arguments, secrets or names leave the machine, and offers a full opt-out.

Tradeoffs

Local installs and self-hosted servers send anonymous usage events by default; you must set an environment variable to stop them. The workspace pins its core functional library to a pre-release beta and carries seven patched third-party dependencies, so upgrades are not trivial. Inside the sandbox the tool namespace refuses to be listed, which means agents have to search for tools rather than list them. The vision document says scopes are currently flattened to organisation and user, and that the global pattern-based policy list is slated for removal, so today's configuration shape may move.

How to use it well

Pick it if you run two or more agents, such as a terminal coding agent and an editor assistant, and are tired of pasting the same keys and server configs into each. Start with the local command for a single machine, or the hosted tier when a cloud chat agent needs the same tools. Review the imported approval defaults before trusting them, and flip a wrongly flagged safe action to allowed. Opt out of telemetry up front if that matters. It does not replace the services themselves or write integrations for undocumented APIs.

Observed

License

MIT (LICENSE)

Language

TypeScript, Bun + Turborepo monorepo (README.md)

Install surface

npm, pnpm, bun or yarn global install of the executor package; requires Node.js 20+ (apps/docs/local/cli.mdx)

Deployment forms

CLI background service, desktop app (Mac, Windows, Linux), hosted cloud with free tier, self-host via Docker or Cloudflare Worker (README.md)

Agent interface

MCP over streamable HTTP or stdio (README.md)

Integration types

MCP servers, OpenAPI, GraphQL, Google Discovery (README.md)

Library interface

TypeScript SDK with Promise and Effect-native APIs (README.md)

Sandbox defaults

QuickJS, 5-minute timeout, 64 MiB memory, fetch disabled (packages/kernel/runtime-quickjs/src/index.ts)

Self-host secret storage

AES-256-GCM with scrypt-derived key; master key required (packages/plugins/encrypted-secrets/src/index.ts)

Telemetry

Anonymous usage events on by default for CLI, desktop and self-host; environment-variable opt-out (TELEMETRY.md)

Tests

Unit and integration suites plus Playwright end-to-end tests (README.md)